CVE-2019-14849CWE-201

A vulnerability was found in 3scale before version 2.6, did not set the HTTPOnly attribute on the user session cookie

Medium · published December 12, 2019

CVSS v3.0
4.6
EPSS
1%
Percentile
43.9
In the wild
Unconfirmed
What it is

A vulnerability was found in 3scale before version 2.6, did not set the HTTPOnly attribute on the user session cookie. An attacker could use this to conduct cross site scripting attacks and gain access to unauthorized information.

The record
Technical detail
CVSS v3.0
4.6 · MEDIUM
Vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00528 · 43.9th percentile
Weakness
CWE-201 · Insertion of Sensitive Information Into Sent Data
Published
2019-12-12T13:14Z
EPSS history
Timeline
  • 12 DEC 13:14Z
    A vulnerability was found in 3scale before version 2.6, did not set the HTTPOnly attribute on the user session cookie
    cvelistv5